THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-13577 (HIGH 8.2) — Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom ar

[NVD] CVE-2026-13577 (HIGH 8.2) — Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom ar

lownvdPublished 2026-07-20

CVE-2026-13577 CVSS: 8.2 HIGH Published: 2026-07-20T08:16:28.987

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.

Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.

The fallback session id is generated fro

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-13577